HSSI, Hanwa's Indonesian subsidiary, was subject to unauthorized access by a third party, and files on its server and some PCs were encrypted. There is currently no conclusive evidence that business-partner information was leaked externally, but recovery is proceeding using backups. The incident was discovered on 20 October, and based on information released on 28 October, the company is investigating the intrusion route and scope of the impact with an external specialist firm.
It was announced that PT. HANWA STEEL SERVICE INDONESIA (HSSI), Hanwa's Indonesian subsidiary, had been subject to unauthorized access by a third party, resulting in the encryption of files on its server and some PCs. The incident was discovered on 20 October. Since then, the company has cut off its internal network and internet connections, isolated devices and proceeded with recovery work.
At the time of disclosure, the affected server stored business-related information provided by business partners and HSSI's internal information, but no evidence had been obtained to confirm that files had been leaked externally. The company continues to investigate the intrusion route and scope of the impact with an external cybersecurity specialist, and further disclosure will be required to determine the full extent of the damage.
Recovery is proceeding by initializing and rebuilding the affected devices and using backup data after confirming their safety. Some operations are reported to have resumed, but the inability to use the files and whether information was leaked externally are currently being treated as separate matters, and further information is awaited.
Similar unauthorized access was identified in 2024 at HANWA THAILAND, another Thai subsidiary. The group has indicated a policy of strengthening its cybersecurity measures across the group. In the present incident, the company is working to protect business-partner information and report the matter to the relevant authorities.